On Fri, Mar 27, 2015 at 8:08 AM, Richard Smith <smithbone@gmail.com> wrote:

Using horst I've discovered that the major reason our WiFi network sucks is because 90% of the packets are sent at the 6mbit rate. Most of the rest show up in the 12 and 24mbit zone with a tiny fraction of them using the higher MCS rates.

Trying to couple the radiotap info with the packet decryption to discover the sources of those low-bit rate packets is where I've been running into difficulty. I can see the what but I haven't had much luck on the why.

I totally agree with you that tools other than wireshark for analyzing this seem to be non-existent.

Using the following filter in Wireshark should get you all that 6Mbps traffic:

radiotap.datarate == 6

Then it's pretty easy to dig into what those are (by wifi frame-type, at least). At my network, that's mostly broadcast traffic (AP beacons and whatnot), as the corporate wifi has been set to use that rate as the broadcast rate.

without capturing the WPA exchange, the contents of the data frames can't be seen, of course.

-Aaron